Security audit
Security checks across malware telemetry and agentic risk
This is a transparent workflow kit, but it can make agents coordinate and start work repeatedly without enough built-in approval boundaries.
Install only if you intentionally want agents to run a self-service team workflow. Before enabling the heartbeat, define which queues and repositories are in scope, require human approval for destructive, deployment, public, financial, account, or credential-related actions, cap agent spawning, and review changes before committing them.
## Key Principles ### 1. Self-Service If work is in the Ready queue, any agent can pick it up. No approval needed. First claim wins. ### 2. Clear Ownership Every phase has ONE owner. No "shared responsibility" (which means no responsibility).
## Key Principles ### Self-Service If it's in Ready, any agent can pick it up. No approval needed. ### Clear Ownership Every phase has ONE owner. No ambiguity.
| Bad | Why | Fix | |-----|-----|-----| | Return HEARTBEAT_OK without checking | Loop dies silently | Actually run the checklist | | Do the work yourself instead of spawning | You become the bottleneck | Spawn specialists | | Ask "what's next?" | That's the team's job to figure out | Check backlog, spawn who's needed | | Wait for human direction | Defeats autonomy | Execute from Ready queue |
66/66 vendors flagged this skill as clean.
No suspicious patterns detected.
